1. Defend to jump out web catalog
 First modify httpd.conf, if you only allow operating your php script in web catalog, you could modify httpd.conf file to resist php operation path. e.g. your web catalog is /usr/local/apache/htdocs, then you just need to add the line in httpd.conf:
php_admin_value open_basedir /usr/local/apache/htdocs
In this case, operations like the script reads files out of the catalog /usr/local/apache/htdocs are not allowed. If you mistake to open, error would prompt:
 Warning: open_basedir restriction in effect. File is in wrong directory in 
　　/usr/local/apache/htdocs/open.php on line 4
2. Defend php Trojan to execute webshell
Open safe_mode, set the file php.ini:
disable_functions= passthru，exec，shell_exec，system , you can choose one of them or both.
3. Defend php Trojan to read/write file catalog
In php.ini, disable_functions= passthru，exec，shell_exec，system
Add php process file function behind.
Mainly:
fopen，mkdir，rmdir，chmod，unlink，dir 
　　fopen，fread，fclose，fwrite，file_exists 
　　closedir，is_dir，readdir.opendir 
　　fileperms.copy，unlink，delfile
become to:
disable_functions= passthru，exec，shell_exec，system，fopen，mkdir，rmdi